Volume 120 (2015) http://dx.doi.org/10.6028/jres.120.002 Journal of Research of the National Institute of Standards and Technology Report on Pairing-based Cryptography Dustin Moody, Rene Peralta, Ray Perlner, Andrew Regenscheid, Allen Roginsky, and Lily Chen National Institute of Standards and Technology, Gaithersburg, MD 20899 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] This report summarizes study results on pairing-based cryptography. The main purpose of the study is to form NIST’s position on standardizing and recommending pairing-based cryptography schemes currently published in research literature and standardized in other standard bodies. The report reviews the mathematical background of pairings. This includes topics such as pairing-friendly elliptic curves and how to compute various pairings. It includes a brief introduction to existing identity-based encryption (IBE) schemes and other cryptographic schemes using pairing technology. The report provides a complete study of the current status of standard activities on pairing-based cryptographic schemes. It explores different application scenarios for pairing-based cryptography schemes. As an important aspect of adopting pairing-based schemes, the report also considers the challenges inherent in validation testing of cryptographic algorithms and modules. Based on the study, the report suggests an approach for including pairing-based cryptography schemes in the NIST cryptographic toolkit. The report also outlines several questions that will require further study if this approach is followed. Key words: IBE; identity-based encryption; pairing-based cryptography; pairings. Accepted: January 21, 2015 Published: February 3, 2015 http://dx.doi.org/10.6028/jres.120.002 1. Introduction Recently, pairings on elliptic curves have been a very active area of research in cryptography. Pairings map pairs of points on an elliptic curve into the multiplicative group of a finite field. Their unique properties have enabled many new cryptographic protocols that had not previously been feasible. The first use of pairings in cryptography was in 1991, when they were used to attack certain elliptic curve cryptosystems that used supersingular elliptic curves. Ten years later, three seminal papers used pairings in a constructive manner to implement novel (or vastly improved) protocols: Boneh and Franklin’s identity-based encryption scheme [1], Boneh, Lynn, and Schacham’s short signature scheme [2], and Joux’s one round tripartite key exchange [3]. Their work jump-started interest in pairing-based cryptography, which has grown exponentially since then. By 2004, there were already over 200 articles published on this topic, and the number today is in the thousands. In particular, identity-based encryption (IBE) has received much attention. With traditional public key cryptography, if a user, Bob, wishes to send a message to another user, Alice, he needs to know Alice’s public key. How can Bob be sure he has Alice’s key, and not some other key substituted by a malicious attacker? There are ways to authenticate Alice’s key using certificates, but in 1984 Shamir proposed the idea of using some form of Alice’s identity for her public key [4]. This could be her email address, for instance. Anyone sending a message to Alice would then know Alice’s public key. One of the main advantages of IBE is that it allows a user to encrypt a message without needing keys to have been 11 Volume 120 (2015) http://dx.doi.org/10.6028/jres.120.002 Journal of Research of the National Institute of Standards and Technology previously distributed. Such a scenario is quite useful if pre-distribution of keys is impractical. It was an open problem to devise an efficient IBE scheme until Boneh and Franklin’s paper in 2001. Besides IBE, there are a number of other applications of pairing-based cryptography. These include many identity-based cryptosystems (including signature schemes), key establishment schemes, functional (or attribute-based) encryption, and privacy-enhancing techniques such as anonymous credentials. Pairing-based cryptography has been adopted commercially. The two largest companies in this field are Voltage Security (co-founded by Boneh), and Trend Micro. In 2008, the National Institute of Standards and Technology (NIST) held a workshop on pairing-based cryptography. Over 80 people from academia, government and industry attended. Dr. Matt Franklin, co-inventor of one of the first practical IBE schemes, presented a keynote address on IBE. The second keynote address was delivered by Brent Waters, who introduced an application of pairing-based cryptography called functional encryption. Functional encryption allows anyone that possesses a particular set of attributes, which are defined at the time the message is encrypted, to decrypt the message. The workshop program included presentations on new applications of pairing-based cryptography. Several presenters described how IBE and other pairing-based cryptography schemes were being used in pilot projects and live systems. The workshop also had two panel discussions. The first panel discussed where and how IBE could fit into the NIST cryptographic toolkit, along with barriers to adoption. This panel included representatives from industry, standards organizations and users. The second panel discussed IBE’s relative strengths and weaknesses compared to traditional public key cryptography, and included panelists with expertise in IBE and public key infrastructure (PKI). The interest in pairings that was evident at the workshop has resulted in efforts to standardize pairing- based protocols. Indeed, the Internet Engineering Task Force (IETF) has started developing certain standards for some pairing-based cryptosystems. The Institute of Electrical and Electronics Engineers (IEEE) is also currently developing similar standards, as is the International Standards Organization (ISO). Throughout the past year, the authors have been meeting to help determine whether or not NIST should begin any standardization. The distinctive properties of pairings enable cryptographic schemes with compelling features, such as IBE. Extensive research must be undertaken before NIST makes recommendations for the use of pairing technologies within the federal government. In this document, we summarize what we have learned, and share our findings. We first give a brief, high-level mathematical background for pairings. More detail can be found in the Appendix. This background will be followed by a discussion of the most important pairing-based protocols. This discussion includes examples of IBE, signature schemes, and key establishment mechanisms. We also survey which pairing-based cryptosystems are being used commercially, as well as potential future uses. We then review the status of pairings in other industry standards. We end with our recommendations. 2. Mathematical Background Since 1985, elliptic curves have been used in cryptography. Elliptic curve cryptosystems have some advantages over other systems. For example, there is a wide range of parameters for a user to choose from. f Given any prime power q = p , (p ≠ 2,3), we can define an elliptic curve over Fq by the equation 2 3 E : y = x + ax + b (1) 3 2 where a and b in Fq are chosen so that 4a + 27b ≠ 0. More importantly, elliptic curve cryptosystems can offer the same level of security as other systems with a much smaller key length. This property has made elliptic curve cryptography an increasingly popular choice. NIST has recommended fifteen specific elliptic curves for government use in cryptographic applications, and NIST has standardized the elliptic curve digital signature algorithm (ECDSA), as well as the Diffie-Hellman and MQV key agreement schemes. A point on the elliptic curve E is represented as an ordered pair (x, y) satisfying Eq. (1). The coordinates x and y are elements of the finite field Fq. There is a way to “add” two points on an elliptic curve, and always get another point. There is also an additional, special point denoted by ∞. The defining property of the point ∞ is that if P is any point on the curve E, then P + ∞ = P. 12 http://dx.doi.org/10.6028/jres.120.002 Volume 120 (2015) http://dx.doi.org/10.6028/jres.120.002 Journal of Research of the National Institute of Standards and Technology A pairing is a function e that takes a pair of two points on an elliptic curve and outputs an element in a finite field. The pairings we consider are also bilinear. This means that the pairing map preserves the additive structure of the elliptic curve, and carries it over into the finite field. For example, e(P1 + P2, Q) = e(P1, Q) * e(P2, Q), where the * denotes multiplication in the finite field. This bilinearity property has enabled the construction of new cryptographic protocols using pairings. Although in theory pairings exist for any elliptic curve, in practice there are curves whose pairings are not suitable for cryptographic applications. Associated to each elliptic curve, there is a parameter that can be calculated known as the embedding degree k. In order to efficiently implement pairings for use in cryptography, we need k to be relatively small, certainly less than 100. However, it has been shown that almost all elliptic curves have very large k. In fact, k is usually about the same size as q, which is at least 160 bits. There are two common ways to find pairing-friendly elliptic curves. The first is to use what are known as supersingular elliptic curves, which always have k ≤ 6. The second way is to use a technique called the complex multiplication (CM) method to construct certain families of elliptic curves with small k. There are advantages and drawbacks to each way. See [5] for a survey paper that reviews all known methods to find such pairing-friendly curves. In order to actually implement any pairing-based cryptographic protocol, it is necessary to also choose a specific pairing function e. The two most commonly used pairings are the Weil and Tate pairings.